Extracted

• • Target
    angelx.exe
  • Size 968KB
  • SHA256 e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
  • MD5 f9ccd51ac26ac9729efb1386644e09bb
  • SHA1 c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
  • SHA512 5d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratevasioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2